Use timing-safe-equal? from (sigil crypto) instead of local copy

Message

Remove local timing-safe-equal? definition from webhook.sgl. The function is now provided by (sigil crypto), which is already imported by this module.

Changed

 src/lemonsqueezy/webhook.sgl | 19 -------------------
 1 file changed, 19 deletions(-)

Diff

src/lemonsqueezy/webhook.sglmodified

@@ -122,25 +122,6 @@

122

(let ((computed (hmac-sha256 secret raw-body)))

123

(timing-safe-equal? computed signature)))

124

−125

;;; Timing-safe string comparison to prevent timing attacks.

−126

;;; Compares every character regardless of mismatches.

−127

;;; Length difference is folded into the result without early return

−128

;;; to avoid leaking length information via timing.

−129

(define (timing-safe-equal? a b)

−130

(let ((len-a (string-length a))

−131

(len-b (string-length b)))

−132

(let ((len (if (> len-a len-b) len-a len-b))

−133

(len-diff (if (= len-a len-b) 0 1)))

−134

(let loop ((i 0) (diff len-diff))

−135

(if (>= i len)

−136

(= diff 0)

−137

(loop (+ i 1)

−138

(+ diff

−139

(if (and (< i len-a) (< i len-b)

−140

(char=? (string-ref a i)

−141

(string-ref b i)))

−142

0 1))))))))

−143

125

;; ---------------------------------------------------------------

126

;; API functions

127

;; ---------------------------------------------------------------